Pre-fill issue body with snapshot + redacted log tail (#3705). Principle VII. #4594
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| on: | |
| pull_request: | |
| branches: [main] | |
| # Skip CodeQL on doc-only PRs — analyzing C++ requires building the | |
| # whole project (~23 min wall clock). The weekly cron below gives | |
| # us a periodic full scan regardless of PR activity. | |
| paths-ignore: | |
| - '**.md' | |
| - 'docs/**' | |
| - 'LICENSE' | |
| - '.gitignore' | |
| - '.github/**' | |
| # Post-merge guard — paired with ci.yml's push:main trigger; same | |
| # paths-ignore rules apply so docs/CI-only merges don't burn 23 min. | |
| push: | |
| branches: [main] | |
| paths-ignore: | |
| - '**.md' | |
| - 'docs/**' | |
| - 'LICENSE' | |
| - '.gitignore' | |
| - '.github/**' | |
| schedule: | |
| - cron: '0 6 * * 1' # weekly Monday 06:00 UTC | |
| # Auto-cancel superseded runs when a newer commit lands on the same PR. PR runs | |
| # share a stable per-PR group (older run cancelled); runs on main append the | |
| # unique run_id so each is its own group — the post-merge push:main scan and the | |
| # weekly scheduled scan (both on main) stay fully parallel, never queue or cancel. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }}${{ github.ref == 'refs/heads/main' && format('-{0}', github.run_id) || '' }} | |
| cancel-in-progress: ${{ github.ref != 'refs/heads/main' }} | |
| # Workflow-level least-privilege GITHUB_TOKEN. CodeQL's official guidance | |
| # (https://github.com/github/codeql-action#permissions) is: | |
| # actions: read — needed by the CodeQL action to inspect this | |
| # workflow's metadata for category info. | |
| # contents: read — needed by actions/checkout to fetch the repo. | |
| # security-events: write — needed by the analyze step to upload SARIF. | |
| # Previously the block sat at job level and declared only | |
| # `security-events: write`, which (per GitHub's "specify any → unspecified | |
| # default to none" rule) dropped contents and actions to none. It worked | |
| # only because the repo is public; tightening to documented scopes makes | |
| # the intent explicit and survives a hypothetical visibility change. | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| jobs: | |
| analyze: | |
| runs-on: ubuntu-latest | |
| container: ghcr.io/ten9876/aethersdr-ci:latest | |
| strategy: | |
| matrix: | |
| language: [cpp] | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 | |
| - name: Fix git ownership for container | |
| run: git config --global --add safe.directory "$GITHUB_WORKSPACE" | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@7c1e4cf0b20d7c1872b26569c00ba908797a59bf | |
| with: | |
| languages: ${{ matrix.language }} | |
| config-file: ./.github/codeql/codeql-config.yml | |
| - name: Configure | |
| run: cmake -B build -G Ninja -DCMAKE_BUILD_TYPE=RelWithDebInfo | |
| - name: Build | |
| run: cmake --build build -j$(nproc) | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@7c1e4cf0b20d7c1872b26569c00ba908797a59bf |